[Webkit-unassigned] [Bug 81868] New: REGRESSION(r98542): crash when MatchedStyleDeclarationCache is resized

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=81868

           Summary: REGRESSION(r98542): crash when
                    MatchedStyleDeclarationCache is resized
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: CSS
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: mikelawther at chromium.org
                CC: koivisto at iki.fi


As reported in http://code.google.com/p/chromium/issues/detail?id=103653:

We've been seeing crashes in Chrome with stacks like:

0x001270c2]    WebCore::RenderStyle::~RenderStyle()
0x0030b8db]    WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem::operator=(WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem const &)
hashtable.h:969]    WTF::HashTable<unsigned int,std::pair<unsigned int,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem>,WTF::PairFirstExtractor<std::pair<unsigned int,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem> >,WTF::IntHash<unsigned int>,WTF::PairHashTraits<WTF::HashTraits<unsigned int>,WTF::HashTraits<WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem> >,WTF::HashTraits<unsigned int> >::rehash(int)
hashtable.h:739]    WTF::HashTable<unsigned int,std::pair<unsigned int,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem>,WTF::PairFirstExtractor<std::pair<unsigned int,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem> >,WTF::IntHash<unsigned int>,WTF::PairHashTraits<WTF::HashTraits<unsigned int>,WTF::HashTraits<WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem> >,WTF::HashTraits<unsigned int> >::add<WTF::HashMapTranslator<WTF::PairHashTraits<WTF::HashTraits<unsigned int>,WTF::HashTraits<WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem> >,WTF::IntHash<unsigned int> >,unsigned int,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem>(unsigned int const &,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem const &)
cssstyleselector.cpp:2624]    WebCore::CSSStyleSelector::addToMatchedDeclarationCache(WebCore::RenderStyle const *,WebCore::RenderStyle const *,unsigned int,WebCore::CSSStyleSelector::MatchResult const &)
cssstyleselector.cpp:2717]    WebCore::CSSStyleSelector::applyMatchedDeclarations(WebCore::CSSStyleSelector::MatchResult const &)
cssstyleselector.cpp:1524]    WebCore::CSSStyleSelector::styleForElement(WebCore::Element *,WebCore::RenderStyle *,bool,bool,WebCore::RenderRegion *)
element.cpp:1037]    WebCore::Element::styleForRenderer()
element.cpp:1061]    WebCore::Element::recalcStyle(WebCore::Node::StyleChange)
element.cpp:1138]    WebCore::Element::recalcStyle(WebCore::Node::StyleChange)
element.cpp:1138]    WebCore::Element::recalcStyle(WebCore::Node::StyleChange)

It appears that the MatchedDeclarationCache gets resized, and while the MatchedStyleDeclarationCacheItems are being copied over (http://trac.webkit.org/browser/trunk/Source/JavaScriptCore/wtf/HashTable.h#L970), something goes wrong in a RenderStyle destructor.

These crashes go as far back as Nov 2011, and started happening around the time http://trac.webkit.org/changeset/98542 went in.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.